Navigate

Check: RHEL-09-653130

RHEL 9 STIG: RHEL-09-653130 (in versions v1 r3 through v1 r1)

Title

RHEL 9 audispd-plugins package must be installed. (Cat II impact)

Discussion

"audispd-plugins" provides plugins for the real-time interface to the audit subsystem, "audispd". These plugins can do things like relay events to remote machines or analyze events for suspicious behavior.

Check Content

Verify that RHEL 9 has the audispd-plugins package for installed with the following command: $ sudo dnf list --installed audispd-plugins Example output: audispd-plugins.x86_64 3.0.7-101.el9_0.2 If the "audispd-plugins" package is not installed, this is a finding.

Fix Text

The audispd-plugins package can be installed with the following command: $ sudo dnf install audispd-plugins

Additional Identifiers

Rule ID: SV-258175r926512_rule

Vulnerability ID: V-258175

Group Title: SRG-OS-000342-GPOS-00133

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-001851	The information system off-loads audit records per organization-defined frequency onto a different system or media than the system being audited.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AU-4 (1)	Transfer To Alternate Storage